Network attack traffic is a serious problem for all information technology users. The goals of network attack are many and varied, to crash a particular machine or particular server, to acquire network information, to misuse data, or to take control of a particular machine. One line of defense is the intrusion detection system.
Intrusion detection systems include host-based systems, network-based systems, and node-based systems. A host-based system generally monitors user activity on the system by examining alert messages, log files, etc., while a network-based system typically monitors all network activity and network traffic, and a node-based system typically monitors network activity to and from a specific computer system to detect attacks.
The term “intrusion detection” means identifying an attack event by matching the attack event to known patterns that are emblematic of malicious traffic, with human interaction frequently required. The term “intrusion protection” means studying the statistical behavior of traffic to deduce whether or not the traffic is malicious, and should be dropped or quarantined. In intrusion detection there may be either automatic reaction by the system or automatic suggestion of a reaction that a human operator can take. In this regard, intrusion detection systems typically create a log for human study.
Intrusion events include attacks by viruses and worms. A virus is software designed to induce a user to execute it, which causes the virus to replicate and distribute itself. Boot viruses attached to the boot sector of a hard disk drive are automatically executed upon booting. File viruses are attached to executable program files so as to execute when a user runs the infected program. As used herein, the term virus includes code that act like a virus, worm, or any variant thereof.
The problems with existing intrusion detection systems include false positives (identifying a benign program as a virus, worm, or other intrusion), false negatives (failing to identify a virus, worm, or other intrusion as an attack, and instead mis-identifying it as a benign program), and the overhead associated with intrusion detection monitoring. A further problem with present intrusion detection systems is that they generate so much data, that is, they capture so many events, that the captured data, that is, identified events, can not be readily interpreted and mapped to identified real intrusion attack risks.
There is a clear need to reduce the number of reported, recorded, and logged intrusion detection events in the Intrusion Detection System.